CVE-2026-11917

HighCVSS 7.2/10Last modified Oct 24, 2026

Description

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

Metrics

CVSS 4.0 7.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-119185.4IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomp CVE-2026-11927.3A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the CVE-2026-119204.9The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'o CVE-2026-119219.1IBM Verify Identity Access containers may not apply management password change operations correctly.CVE-2026-119226.5A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and CVE-2026-119237.4IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container CVE-2026-119252.7Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.CVE-2026-119267.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request res CVE-2026-119276.5IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.CVE-2026-119289.8IBM Verify Identity Access is vulnerable to a buffer overflow attack.CVE-2026-119297.5IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of use CVE-2026-11938.8A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the compo